Question

A security operations engineer is onboarding a high-volume firewall log source into Google SecOps. Legal and compliance require that all authentication and connection-block events be retained and searchable, but the firewall also generates massive volumes of low-value 'connection-allowed' informational events that consume ingestion budget without contributing to detections. The team wants to reduce ingestion cost while preserving security-relevant telemetry and normalization quality. What is the most appropriate approach?

Accepted Answer

Configure ingestion-time filtering to drop the low-value 'connection-allowed' informational events before they are ingested, while allowing block and authentication events through for parsing and normalization

Answer

Ingest all events unchanged and rely on data RBAC to hide the informational events from analysts to reduce perceived volume

Answer

Disable the parser for this log source so the raw logs are stored without normalization, lowering compute cost

Answer

Shorten the global data retention period for the entire tenant so the informational events age out faster